The Ten-Day Answer Services vCISO Advisory Leadership Baseline Cyber Insurance Readiness HIPAA Risk Assessment Risk Assessment MSP Security Oversight Industries Healthcare Financial Services Manufacturing & Logistics Legal & Professional Construction Defense Suppliers Locations Tacoma & Pierce County Spokane & Eastern WA Coeur d'Alene & North Idaho Resources Free Insurance Readiness Checker Cyber Insurance Application Guide Security Questionnaire Guide What a vCISO Costs vCISO vs MSP WA My Health My Data Act FTC Safeguards Rule Blog For MSPs & MSSPs About Community Contact Get a Ten-Day Answer
Get a Ten-Day Answer Call
Home › Resources › Security Questionnaire Guide

How to answer a security questionnaire as a small business

A customer sent a SIG, a CAIQ, a HECVAT, or a 200-row spreadsheet, and the deal is waiting. Here is how the common formats work, how buyers read your answers, how to answer honestly when you are partway there, and how to make the next one take a fraction of the time.

Get help with your questionnaire → or book a free 30-minute call

What is a security questionnaire, and why did you get one?

A security questionnaire is a buyer's way of checking whether your company can be trusted with their data or systems before they sign. Their procurement, security, or compliance team sends it to every vendor in scope. Your answers get scored, followed up on, and often attached to the contract.

You probably got one because you handle the customer's data, connect to their systems, or support something they depend on. Larger customers are often required by their own regulators, auditors, or insurers to assess vendors. It is not personal, and it is not a test you pass with a perfect score. It is a record of what you told them.

What are the common security questionnaire formats?

Most questionnaires are one of four types: the SIG or SIG Lite from Shared Assessments, the CAIQ from the Cloud Security Alliance, the HECVAT from EDUCAUSE for higher education, or a custom spreadsheet the buyer built. The questions overlap heavily, which is why a reusable answer library pays off.

SIG and SIG Lite (Shared Assessments)

The Standardized Information Gathering questionnaire, or SIG, is published by Shared Assessments to standardize the initial assessment of vendors. It spans risk domains including cybersecurity, IT, privacy, data governance, and business resiliency, and is updated at least annually. SIG Core is the comprehensive version; SIG Lite is the shorter one, intended for basic due diligence or less critical vendors. The buyer licenses it through a membership or subscription, so you will typically receive a copy from them rather than download one. Many buyers remove sections that do not apply, so read the version you received rather than assuming.

CAIQ (Cloud Security Alliance)

The Consensus Assessments Initiative Questionnaire, or CAIQ, is published by the Cloud Security Alliance. It documents which security controls exist in a cloud service (IaaS, PaaS, or SaaS) using yes or no questions mapped to CSA's Cloud Controls Matrix. It is also the questionnaire providers use to self-assess for CSA's STAR Registry. If you sell software or a hosted service, expect it. If you do not run a cloud service, many questions will be "not applicable," and you should say so plainly.

HECVAT (higher education)

The Higher Education Community Vendor Assessment Toolkit, or HECVAT, is a community-driven questionnaire from EDUCAUSE that colleges and universities use to evaluate solution providers. With HECVAT 4, the former Full, Lite, and On-Prem versions were combined into one file, and the vendor works out which questions apply to their product. If you sell to a university, ask which version they want before you start.

Custom spreadsheets

Many buyers send their own spreadsheet, sometimes built from pieces of the formats above, sometimes written by their legal or procurement team. These are the hardest to answer because the wording is often vague or written for a much larger company. Read each question for its intent, answer that intent, and note any assumption you made.

How do buyers actually score security questionnaires?

Most reviewers do not add up a score and compare it to a cutoff. They look for answers that raise risk for their data, check whether those answers are credible, and ask follow-up questions. A few high-impact items, such as MFA, encryption, backups, and incident notification, usually carry most of the weight.

In practice, reviewers tend to:

  • Flag every no and every vague yes on controls tied to their data, then send follow-ups or request evidence.
  • Check consistency. A yes on "we encrypt data at rest" next to "we do not have an asset inventory" invites questions about how you know.
  • Sample evidence. They may ask for a policy, a screenshot, or a certificate for a handful of answers. A yes you cannot support hurts your credibility on every other answer.
  • Turn gaps into contract terms. A planned control often becomes a contract commitment with a date. That is normal, and fine, if the date is real.

How do you answer honestly when you are only partly there?

Use one of three honest patterns instead of a bare yes or no: "Yes, with scope" when a control covers some systems, "Planned by date" when work is scheduled, and "Compensating control" when you reduce the risk another way. Each tells the reviewer exactly where you stand and what to expect.

  • Yes, with scope. "Yes. MFA is enforced for all users on Microsoft 365 and for all remote access. One legacy accounting server is accessible only from the internal network and does not support MFA."
  • Planned by date. "Not yet. Endpoint detection and response is scheduled for deployment to all workstations and servers by June 30, owned by our IT provider." Only commit to dates you will meet, because they may land in the contract.
  • Compensating control. "We do not hold a formal penetration test report. External vulnerability scans run monthly and findings are tracked to closure by our MSP."

Avoid "N/A" unless the control truly does not apply, and say why. An unexplained N/A looks like a dodge.

How do you build a reusable answer library and trust pack?

After your first questionnaire, save every final answer, sorted by topic, with the evidence behind it and the date it was last confirmed. Then assemble a small trust pack of documents you can share on request. The next questionnaire becomes mostly copy, check, and send.

The answer library

Keep a single spreadsheet or document organized by control area: access and MFA, endpoint protection, backups, encryption, logging, vendor management, incident response, policies, and personnel. For each answer, record the approved wording, the scope, the evidence location, the owner, and a review date. Review it at least once a year and after any major change, like a new IT provider.

The trust pack

  • Core policies: information security, acceptable use, access control, incident response, and backup or business continuity.
  • An architecture summary: one or two pages describing where customer data lives, the main platforms you use, and how access is controlled, written in plain language.
  • A certificate of insurance showing your cyber coverage, if you carry it.
  • A SOC 2 report or bridge letter, if you have one. A bridge letter covers the gap between your last report period and today. If you have no SOC 2, do not imply otherwise.
  • A short security overview that answers the top ten questions every buyer asks.

What not to send

  • Raw vulnerability scan output or penetration test reports. Send a summary of cadence, scope, and remediation process instead.
  • Network diagrams with IP addresses, hostnames, firewall rules, or device models.
  • Screenshots that expose usernames, internal URLs, or configuration details beyond what proves the point.
  • Anything sensitive without an NDA in place. For truly sensitive material, offer a screen-share review instead of a file.

What about the contract security exhibit or DPA that came with it?

Treat the security exhibit or data processing agreement as the binding version of the questionnaire. The questionnaire describes what you do today; the exhibit says what you must do for the life of the contract. Read them side by side and make sure nothing in the exhibit promises more than your answers support.

  • Notification windows. Exhibits often require notice of a security incident within a fixed number of hours. Make sure your incident response plan can actually meet that, including nights and weekends.
  • Specific controls. Watch for named requirements like encryption standards, MFA everywhere, annual penetration tests, or background checks. If you do not do it today, negotiate a date or different wording before you sign.
  • Audit rights. Some exhibits allow the customer to audit you. Understand the scope, notice period, and who pays.
  • Subprocessors and flow-downs. A DPA may require you to list subprocessors, such as your cloud and IT providers, and pass the same terms down to them.
  • Insurance requirements. Check required coverage types and limits against your actual policy.

We help you understand what the security terms require operationally and where your answers and the exhibit disagree. This is not legal advice; your attorney should review contract language before you sign. For ongoing contract and questionnaire volume, a fractional CISO keeps your answers consistent over time.

Typical Turnaround

What does a 10-day questionnaire turnaround look like?

Ten business days is a realistic window for most small-business questionnaires when the right people are available. You spend a few hours in interviews; the rest is drafting, confirming, and review.

Days 1-2

Scope and triage

Confirm the deadline, the format, and who at your company and your MSP knows the answers. Pull any existing policies and past answers. Sort questions into known, needs confirmation, and not applicable.

Days 3-7

Interviews and drafting

Short interviews with your team and IT provider. Draft every answer, mark scope or planned dates where needed, and note the evidence behind each yes. Compare against any security exhibit or DPA.

Days 8-10

Review and send

The accountable person reviews the final answers and any gaps. Assemble the attachments, save answers to your library, and send it back with a short cover note.

Who Gets These

Questionnaires show up in every industry we serve.

Healthcare →

Payer and hospital vendor assessments, often paired with a BAA.

Manufacturing →

Supplier security questionnaires from OEMs and prime customers.

Professional Services →

Corporate client questionnaires and outside-counsel security guidelines.

Defense Suppliers →

Prime contractor flow-down questionnaires and DFARS clauses.
Get It Answered

A deal is waiting on a questionnaire? Send it to us.

The Ten-Day Answer is $3,500, fixed fee, ten business days, one questionnaire. You get the completed document in your voice, a gap register with an owner and date for every non-clean answer, a one-page remediation plan for your MSP, and a 30-minute readout. Advisory only: we never touch your systems and work alongside your IT provider. If the questionnaire shows bigger gaps, a Leadership Baseline or MSP security oversight is the usual next step. We work with businesses in Tacoma, Spokane, and North Idaho.

Start your Ten-Day Answer → or see how the Ten-Day Answer works
Frequently Asked Questions

Security questionnaire questions, answered.

A first questionnaire often takes one to two weeks of part-time effort because the answers have to be found, confirmed with your IT provider, and written down. Once you have an answer library and trust pack, later questionnaires usually go much faster because most answers are reused.

Both are published by Shared Assessments. SIG Lite is the shorter version, used for initial due diligence or lower-risk vendors. SIG Core is the comprehensive, risk-based version. Buyers choose which one to send, and many trim or customize it.

Yes. An honest no with context, such as a compensating control or a planned completion date, is usually far better received than a yes that fails when the buyer asks for evidence. Reviewers expect small companies to have some gaps. They are looking for honesty and a plan.

No. Many small businesses answer questionnaires without a SOC 2 report. Some buyers require one for certain contracts, so ask early. If you have no report, a clear set of policies, an architecture summary, and honest answers often carry the review.

Generally no. Raw scan output and diagrams with IP addresses, hostnames, or device models give away a map of your environment. Send a summary instead, such as the scan cadence, the tool category, and how findings are tracked to closure, or offer a screen-share review under NDA.

Someone accountable for security at your company should review the final answers, even if your MSP drafted the technical parts. Answers often end up referenced in a contract, so the person who owns that relationship should understand what was promised.

Yes. The Ten-Day Answer is a $3,500 fixed-fee engagement that returns one completed questionnaire in ten business days, written in your voice, with a gap register and a remediation plan your MSP can execute. We never touch your systems.

Something security-related landed on your desk?

Send it to us. One questionnaire, insurance application, or contract exhibit, answered in ten business days for a fixed $3,500.

Get Your Ten-Day Answer or book a free 30-minute call